From Infection to Leak: 648 Hotmail Logins Exposed June 27

The timeline on this one is short. Malware infects a device, quietly copies its saved logins, and by June 27, 2026, a file labeled "648x UHQ Hotmails" containing 648 records was already circulating on Telegram. HEROIC analysts recovered the file and confirmed it holds email addresses, plaintext passwords, and the URLs each login was used on, all tied to Hotmail accounts.

Why This Is Dangerous

The gap between infection and public exposure is often measured in days, not months, which means the credentials in this file are likely to still be active. Because the passwords were stored in plaintext, there is no delay for cracking, an attacker can start testing logins the moment they download the file.

What Was Exposed

• Email addresses
• Plaintext passwords
• URLs tied to each set of credentials

Why This Matters

For the 648 people whose Hotmail credentials appear in this file, the immediate risk is credential stuffing on other accounts sharing the same password, followed by account takeover if a match is found. Because email accounts are often used to reset passwords elsewhere, one compromised Hotmail login can open the door to banking, shopping, or social media accounts too.

How Stealer Logs Work

Stealer logs like this one move fast. Malware installs itself on a device, harvests saved browser credentials almost immediately, and sends the data back to whoever controls it. That person compiles the stolen logins into a file and distributes it, often within days of the original infection, which is exactly the kind of short timeline seen in this 648-record Hotmail leak.

Check If You Are Affected

Because these files can appear and spread within days of infection, checking your exposure promptly matters. HEROIC's free breach scanner searches more than 400 billion exposed records, including stealer logs like this one, so you can find out right away and change any password that turns up.